CVE-2026-79772: Nokogiri before 1.19.1 Unchecked Return Value canonicalize
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Nokogiri versions before 1.19.1 are affected when downstream SAML libraries rely on Nokogiri's canonicalize method for XML signature validation.
What must an attacker do to exploit the flaw?
The attacker must provide invalid canonicalized XML to a vulnerable signature-validation path. The failed canonicalization can produce an empty string that downstream SAML code may incorrectly accept as valid.
How can I determine whether remediation is needed?
Check the installed Nokogiri version and identify whether it is used by SAML functionality that validates XML signatures. Versions earlier than 1.19.1 require remediation.
What is the available fix?
Upgrade Nokogiri to version 1.19.1 or later, where failure from xmlC14NExecute is handled rather than returned as an empty string.